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What GAO Found 

U.S. Immigration and Customs Enforcement (ICE) has not developed a process 
to identify and analyze program risks since assuming responsibility for the 
Student and Exchange Visitor Program (SEVP) in 2003, in accordance with 
internal controls standards and risk management guidance. Within ICE, officials 
from SEVP and the Counterterrorism and Criminal Exploitation Unit (CTCEU), 
which tracks, coordinates, and oversees school fraud investigations, have 
expressed concerns about the fraud risks posed by schools that do not comply 
with requirements. Investigators said that identifying and assessing risk factors, 
such as the type of school, are critical to addressing potential vulnerabilities 
posed across the more than 10,000 SEVP-certified schools. However, SEVP 
does not have processes to (1) evaluate prior and suspected cases of school 
noncompliance and fraud and (2) obtain and assess information from CTCEU 
and ICE field offices on school investigations and outreach events. For example, 
ICE reported that it has withdrawn at least 88 schools since 2003 for non- 
compliance; however, ICE has not evaluated schools’ withdrawals to determine 
potential trends from their noncompliant actions because case information is not 
well-organized, according to SEVP officials. Without a process to analyze risks, it 
will be difficult for ICE to provide reasonable assurance that it is addressing high- 
risk vulnerabilities and minimizing noncompliance. 

ICE has not consistently implemented existing controls, in accordance with 
internal control standards and fraud prevention practices, to verify schools’ 
legitimacy and eligibility during initial SEVP certification and once schools begin 
accepting foreign students. Specifically, ICE officials do not consistently verify 
certain evidence initially submitted by schools in lieu of accreditation. In addition, 
ICE does not maintain records to document SEVP-certified schools’ ongoing 
compliance. GAO found that 30 of a randomly-selected sample of 48 SEVP- 
certified school case files lacked at least one piece of required evidence, such as 
proof of school officials’ citizenship or permanent residency. ICE was unable to 
produce 2 of the 50 case files. ICE officials noted that some files were missing 
because they were lost or destroyed when the Department of Homeland Security 
(DHS) took over the program from the former Immigration and Naturalization 
Service; moreover, ICE officials cannot quantify how many files are missing. 
Without verification of evidence and complete case files, ICE cannot provide 
reasonable assurance that schools were initially and continue to be eligible for 
certification. Further, ICE policies require that SEVP-certified flight schools 
offering flight training have specific Federal Aviation Administration (FAA) 
certifications; however, GAO found that approximately 167 of 434 (or 38 percent) 
SEVP-certified flight schools do not have the required certifications as of 
December 201 1 . The Border Security Act required recertification for all SEVP- 
certified schools by May 2004 and every 2 years thereafter to monitor schools’ 
continued program eligibility. SEVP officials stated that they rely on recertification 
to verify schools’ eligibility; however, SEVP began the first recertification cycle in 
May 201 0 and, as of March 201 2, has recertified 1 ,870 (or 1 9 percent) of certified 
schools. Implementing procedures to monitor state licensing and accreditation 
status for all types of schools and addressing flight schools that lack required 
FAA certification could better position ICE to reduce the risk of fraud and 
noncompliance. 
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United States Government Accountability Office 
Washington, DC 20548 


June 18, 2012 
Congressional Requesters 

As of January 2012, more than 850,000 active foreign students in the 
United States were enrolled at over 10,000 schools. 1 We have previously 
reported that terrorist attacks in the United States have pointed to the 
need for close monitoring and oversight of foreign students. 2 For 
example, one of the September 1 1 , 2001 , terrorists entered the country 
on a student visa, and subsequently attended flight schools. Two of the 
September 1 1 , 2001 , terrorists received visas for temporary visits to the 
United States for business or pleasure, and, after entering the country, 
illegally attended flight schools. 3 In addition, as we reported in April 2011, 
schools have sometimes attempted to exploit the immigration system by 
knowingly reporting that foreign students were fulfilling their visa 
requirements, such as maintaining a full course load, when they were not 
attending school or attending intermittently. 4 

U.S. Immigration and Customs Enforcement (ICE), within the Department 
of Flomeland Security (DHS), is responsible for managing the Student 
and Exchange Visitor Program (SEVP), which was created in conjunction 
with DPIS’s formation on March 1, 2003. 5 Under this program, ICE is 
responsible for ensuring that foreign students studying in the United 


^he Department of Homeland Security reports that the five countries with the highest 
number of active foreign students are China, South Korea, India, Saudi Arabia, and 
Canada. These countries account for more than 50 percent of the total number of active 
foreign students in the country. Of active foreign students, 70 percent are enrolled in 
bachelor’s, master’s, or doctoral post-secondary programs. 

2 GAO, Overstay Enforcement: Additional Mechanisms for Collecting, Assessing, and 
Sharing Data Could Strengthen DHS’s Efforts but Would Have Costs , GAO-1 1-41 1 
(Washington, D.C.: Apr. 1 5, 201 1 ). 

temporary visitors to the United States generally are referred to as “nonimmigrants.” The 
United States also issues visas to people who intend to immigrate to the United States. In 
this report, we use the term “visa” to refer to nonimmigrant visas only. For a listing and 
descriptions of nonimmigrant categories, see 8 U.S.C. § 1101 (a)(1 5); see also 8 C.F.R. § 
214.1 (a)(1)-(2). 

4 GAO-1 1-411. 

5 The former Immigration and Naturalization Service was previously responsible for 
monitoring foreign students in the United States and the schools that accept them. 
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States comply with the terms of their admission into the country. 
Specifically, ICE certifies schools as authorized to accept foreign students 
in academic and vocational programs. In addition, ICE manages the 
Student and Exchange Visitor Information System (SEVIS), which assists 
the agency in tracking and monitoring certified schools, as well as 
students — while they are approved to participate in U.S. educational 
institutions — and their dependents. 6 Designated school officials are 
responsible for monitoring students and entering and maintaining 
students’ information in SEVIS, such as information on their courses of 
study. 7 SEVP-certified schools span all education levels from 
kindergarten to secondary education, as well as post-secondary 
academic, vocational, English language, and flight schools. 8 SEVP’s 
fiscal year 2012 enacted budget authority is $120 million, and, as of 
December 201 1 , the program includes authorized staff of 1 51 full-time 
government employees and approximately 600 full- and part-time 
contractors. 

You asked us to review ICE’s fraud prevention and detection procedures, 
including whether it uses risk factors to inform its efforts to monitor SEVP- 
certified schools. This report examines the extent to which ICE has (1) 
identified and assessed risks in SEVP, and (2) developed and 
implemented policies and procedures to prevent and detect fraud during 
the initial school certification process and once schools begin accepting 
foreign students. 


®The Illegal Immigration Reform and Immigrant Responsibility Act of 1996, as amended, 
requires a program to collect information for tracking and monitoring foreign students from 
approved institutions of higher education, other approved educational institutions, and 
designated exchange visitor programs in the United States. See 8 U.S.C. § 1372. The 
statute, as amended by the Enhanced Border Security and Visa Entry Reform Act of 2002 
(Border Security Act), requires that an electronic means be established to monitor and 
verify the acceptance of foreign students by schools and that schools inform DHS of 
foreign students who fail to enroll within 30 days after the end of a school’s enrollment 
period. See Pub. L. No. 1 07-1 73, § 501 (a)(1 ), 1 1 6 Stat. 543, 560-61 (codified at 8 U.S.C. 

§ 1372(a)(3)-(4)). 

7 A designated school official is a regularly-employed member of the school administration 
whose office is located at the school and whose compensation does not come from 
commissions for recruitment of foreign students. The designated school official is required 
to be familiar with the regulations governing nonimmigrant students and school 
certification (8 C.F.R. § 214.3(1)). 

Vocational schools are community colleges, junior or 2-year institutions, high schools, 
and other types of schools that provide vocational or technical training, usually leading to 
a job rather than a bachelor’s degree. 
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To evaluate the extent to which ICE has identified and assessed risks in 
SEVP, we analyzed documentation on ICE’s efforts to evaluate SEVP 
risk, including a current contract to develop a risk management approach. 
We also analyzed ICE news bulletins to help determine the magnitude of 
previous cases of fraud and evaluated information provided by the 
Counterterrorism and Criminal Exploitation Unit (CTCEU) — ICE’s 
investigative component responsible for investigating school fraud cases, 
among other things — on criminal investigations related to school 
certification fraud. We reviewed publicly available information on 12 cases 
of school fraud dating from 2006 to 201 1 , which allowed us to better 
understand SEVP program risks. Because we selected a 
nongeneralizable sample of 12 cases to review, the information obtained 
from them is not necessarily representative of all school fraud cases 
nationwide. We also compared ICE’s risk management practices for 
SEVP against Standards for Internal Control in the Federal Government 9 
and DHS’s Policy for Integrated Risk Management . 10 To determine the 
extent to which ICE has developed and implemented policies and 
procedures to prevent and detect school fraud, we reviewed standard 
operating procedures and tested internal controls designed to ensure 
school oversight. To test SEVP’s internal controls, we selected a 
nongeneralizable, stratified random sample of 50 SEVP-certified schools 
and reviewed their case files to verify that evidence required for 
certification existed, such as designated school officials’ proof of 
citizenship or lawful permanent residency. The results of our case file 
review provided us with insights into SEVP’s internal controls and case 
management practices. Further, we reviewed SEVP’s compliance case 
log, as of December 201 1 , which identifies specific SEVP-certified 
schools that are under additional review for suspected non-compliant 
activity, to identify common school attributes such as type of school. 

To address both objectives, we interviewed officials from each of SEVP’s 
seven branches * 11 and criminal investigators from CTCEU, as well as 


9 GAO, Standards for Internal Control In the Federal Government , GAO/AIMD-OO-21 .3.1 
(Washington, D.C.: Nov. 1, 1999). 

10 Department of Homeland Security, DHS Policy for Integrated Risk Management 
(Washington, D.C.: May 27, 2010). 

11 SEVP has seven branches: School Certification, Response, Policy, Analysis and 
Operations Center, Field Representative Program, Mission Support, and Information 
Technology. 
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eight ICE field offices, which allowed us to obtain their perspective on the 
magnitude and risks associated with school fraud. 12 We selected these 
locations based on their experience in investigating previous and/or 
ongoing cases of school fraud. Although the results from these interviews 
cannot be generalized to officials at all 26 ICE field offices, they provided 
us with useful insights into lessons learned from fraud cases. Additionally, 
we compared ICE’s risk management and fraud prevention and detection 
practices to the Standards for Internal Control in the Federal 
Government' 3 and the United Kingdom National Audit Office’s Good 
Practice in Tackling External Fraud. u Our review encompassed ICE’s 
management of SEVP since 2003, when the agency assumed 
responsibility for managing the program. Our scope did not include the 
Exchange Visitor Program, a separate program administered by the 
Department of State. 15 Appendix I presents more details about our 
objectives, scope, and methodology. 

We conducted this performance audit from September 201 1 through June 
2012 in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit to 
obtain sufficient, appropriate evidence to provide a reasonable basis for 
our findings and conclusions based on our audit objectives. We believe 


12 We interviewed officials from ICE field offices in Atlanta, Ga; Dallas, Tex; Miami, Fla; 

New York, N.Y.; Washington, D.C.; and Los Angeles, San Diego, and San Francisco, 

Calif. 

13 GAO/AIMD-00-21 .3.1 . 

14 U.K. National Audit Office, Good Practice in Tackling External Fraud (London, England: 
2008). This guidance on fraud control practices was prepared by the U.K.’s National Audit 
Office, which is among the internationally recognized, leading organizations in fraud 
control. This guidance includes a discussion of sound management practices for 
controlling fraud that complements the internal control standards. See GAO, Immigration 
Benefits: Additional Controls and a Sanctions Strategy Could Enhance DHS’s Ability to 
Control Benefit Fraud, GAO-06-259 (Washington, D.C.: Mar. 10, 2006). 

15 The Exchange Visitor Program allows nonimmigrants to travel to the United States on a 
J visa to teach, study, conduct research, and receive on-the-job training. Such 
nonimmigrants are monitored by program sponsors, including employers, cultural 
exchange organizations, professional associations, and government agencies. We did not 
evaluate this program because it is a separate process administered by the Department of 
State, and our focus was on DFIS’s oversight of schools that enroll foreign students. For 
more information on the Exchange Visitor Program, see GAO, State Department: Stronger 
Action Needed to Improve Oversight and Assess Risks of the Summer Work Travel and 
Trainee Categories of the Exchange Visitor Program, GAO-06-106 (Washington, D.C.: 

Oct. 14, 2005). 
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that the evidence obtained provides a reasonable basis for our findings 
and conclusions based on our audit objectives. 


Background 


Foreign students interested in studying in the United States must first be 
admitted to a school or university before applying for a visa at a U.S. 
embassy or consulate overseas. 1 * * * * * * * * * * * * * * 16 The process for determining who will 
be issued or refused a visa, including F and M visas, contains several 
steps, including documentation reviews, in-person interviews, collection of 
applicants’ fingerprints, and cross-references against State’s name-check 
database. 17 F visas are for academic study at 2- and 4-year colleges and 
universities and other academic institutions. 18 M visas are for 
nonacademic study at institutions, such as vocational and technical 
schools. 19 An increasing number of foreign students have applied for 
visas to attend school in the United States since fiscal year 2005. 
Specifically, the Department of State issued approximately 244,000 F and 
M visas in fiscal year 2005 and approximately 457,000 in fiscal year 201 1 
(see figure 1). 


1 According to the Department of State’s regulations, a student visa applicant must meet 
the following requirements to qualify: (1) acceptance at an approved school; (2) 

possession of sufficient funds; (3) sufficient knowledge of the English language to 

undertake the chosen course of study or training (unless coming to participate exclusively 

in an English language training program); and, (4) present intent to leave the United 

States at conclusion of studies. See 22. C.F.R. § 41 .61 (b)(1 ). According to the 

Department of State guidance for consular officers, if an applicant fails to meet one or 

more of the above criteria, he or she must be refused a visa under section 214(b) of the 

Immigration and Nationality Act (8 U.S.C. § 1 184(b)). If consular officers have reason to 

believe that a visa applicant engaged in fraud or misrepresentation to garner acceptance 

into a school, then consular officers are instructed to consider this as an important factor 

in determining if the applicant has a bona fide intent to engage in study in the United 

States. If consular officers have reason to question the authenticity of a school, they are 

instructed to contact SEVP and the fraud prevention office in the Bureau of Consular 
Affairs. 

17 We have previously reported on visa process issues. For example, see GAO, Border 

Security: Strengthened Visa Process Would Benefit from Improvements in Staffing and 

Information Sharing , GAO-05-859 (Washington, D.C.: Sept. 13, 2005). 

1S 8 U.S.C. § 1 1 01 (a)(1 5)(F); 8 C.F.R. § 21 4.2(f). 

19 8 U.S.C. § 1101(a)(15)(M); 8 C.F.R. § 214.2(m). 
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Figure 1 : Total Academic (F) and Vocational (M) Visas Issued by the Department of 
State, Fiscal Years 2005 through 2011 


Visas issued 
500,000 



Fiscal year 

| | M Visas (Vocational) 

| | F Visas (Academic) 

Source: Department of State data 

Note: Data include initial issuances and any renewals per fiscal year. 


A visa allows a foreign citizen to travel to a U.S. port of entry and request 
permission from an officer with DHS’s Customs and Border Protection to 
enter the United States; it does not guarantee entry into the country. 
Among other things, foreign students remain “in status” and therefore 
eligible to remain in the United States as students as long as they are 
enrolled in a school certified by SEVP. Individuals traveling on student 
visas generally are not issued a specific date until which they are 
authorized to remain in the United States, but instead are admitted for 
what is referred to as “duration of status.” This means that they may 
remain in the country as long as they maintain their student status (e.g., 
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by being enrolled in an academic or work-study program). 20 Some 
nonimmigrants enter the country on a non-student visa and subsequently 
apply to U.S. Citizenship and Immigration Services for a change in status 
to a student visa. In general, if students fail to maintain their student 
status or to depart on time, they are considered out of status and begin to 
accrue unlawful presence either on the day after U.S. Citizenship and 
Immigration Services or an immigration judge determines that they are 
out of status or on the day after their authorized period of admission 
expires. 21 

Schools interested in accepting foreign students on F and M visas must 
petition for SEVP certification by submitting a Form 1-17 to ICE and 
paying an application fee. Once certified, schools are able to accept 
foreign students by issuing Forms 1-20 for students, which enable the 
students to apply for nonimmigrant student status. As of March 2012, 
students applying for F or M visas were required to pay a $140 fee to the 
Department of State for visa processing and a $200 fee to DFIS for 
SEVIS, and schools applying for initial certification were required to pay 
DFIS $1 ,700, as well as a $655 site visit fee per campus. 22 The Border 
Security Act requires DFIS to confirm, every 2 years, SEVP-certified 
schools’ continued eligibility and compliance with the program’s 
requirements. 23 During the initial petition and recertification processes, a 
school must provide ICE with evidence of its legitimacy and its eligibility. 
Such evidence includes the following: 


20 Students traveling on M visas (students in vocational or other nonacademic institutions) 
generally are admitted for a fixed time period, although extensions are possible. See 8 
C.F.R. § 214.2(m)(5), (10). 

21 They are subject to 3- tol 0-year bars on their readmission to the country, respectively, if 
they accrue more than 180 days or 1 year of unlawful presence. See 8 U.S.C. § 
1182(a)(9)(B). 

22 SEVP and the program’s management of SEVIS are funded solely with the fees it 
collects from foreign students as well as schools applying for certification. When the Illegal 
Immigration Reform and Immigrant Responsibility Act of 1996 (IIRIRA) first required the 
establishment of SEVIS, it required that schools collect the SEVIS fee. See Pub. L. No. 

1 04-208, div. C, § 641 (e), 1 1 0 Stat. 3009-546, 3009-706. The Visa Waiver Permanent 
Program Act amended IIRIRA to require that the government collect the fee. See Pub. L. 
No. 106-396, §404(1), 114 Stat. 1637, 1649 (2000). 

23 8 U.S.C. § 1762. 
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• designated school officials’ attestation statements that both the school 
and officials intend to comply with program rules and regulations, 
such as ensuring that students attend classes, and that the school is 
eligible for certification. The attestations provide that willful 
misstatements constitute perjury; 

• designated school officials’ proof of U.S. citizenship or lawful 
permanent residency; and 

• proof of licensing by an appropriate state-level licensing or approving 
agency. 

In addition, accredited schools must provide proof of certification by an 
accrediting agency recognized by the Department of Education . 24 
Unaccredited schools must provide other evidence, including: 

• a school catalog or written statement including information on the 
school’s facilities and faculty; 

• for unaccredited schools seeking to enroll F visa students, “in lieu of” 
letters from three accredited institutions stating that graduates or 
credits of the petitioning school are unconditionally accepted at the 
accredited institution; 

• for unaccredited schools seeking to enroll M visas students, “in lieu of” 
letters from three employers stating that graduates of the petitioning 
school are fully qualified in the field of training provided by the 
petitioning school; and 

• for schools offering flight training, Federal Aviation Administration 
(FAA) certificates. 

Following a school’s petition and receipt of supporting evidence, ICE uses 
contracted firms to conduct a site visit to the school, including each 
instructional site foreign students attend, to interview school officials and 
review the facilities. In particular, site inspectors review whether schools’ 
facilities are commensurate with the number of students and type of 
academic programs. After receiving all necessary evidence and a site 
visit report from the contracted firm, ICE staff in the SEVP School 


?4 

The goal of accreditation is to ensure that education provided by institutions of higher 
education meets acceptable levels of quality. Accrediting agencies, which are private 
educational associations of regional or national scope, develop evaluation criteria and 
conduct peer evaluations to assess whether or not those criteria are met. Institutions 
and/or programs that request an agency’s evaluation and that meet an agency’s criteria 
are then “accredited” by that agency. There are more than 70 accrediting bodies 
recognized by the Department of Education, including the Accrediting Council for 
Continuing Education and Training, and the Accrediting Commission of Career Schools 
and Colleges. 
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Certification Branch analyze the documentation, determine the school’s 
eligibility, and certify those schools that they determine meet all of the 
program’s requirements. According to the School Certification Branch 
Chief, the initial certification process takes at least 4 months. During the 
recertification process, the School Certification Branch requires schools to 
resubmit evidence for certification and evaluates schools’ compliance with 
recordkeeping and reporting on its enrolled foreign students. Figure 2 
illustrates the initial certification and recertification processes that are 
described in SEVP’s regulations, policy, and guidance. 


Figure 2: Key Steps in SEVP’s Initial and Recertification Processes 



Source: GAO analysis of ICE regulations and documentation. 


ICE’s SEVP Analysis and Operations Center (compliance unit) may 
conduct out-of-cycle, compliance reviews of certified schools at its 
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discretion. The compliance unit may decide to conduct a compliance 
review if it has evidence that indicates a school may no longer be 
legitimate or eligible. As part of these reviews, SEVP staff may conduct 
unannounced site visits to schools. Based on the results of compliance 
reviews, some schools may be withdrawn from the program or referred to 
CTCEU for possible criminal investigation. 25 

CTCEU tracks, coordinates, and oversees criminal investigations related 
to potential cases of student and school certification fraud. In that role, 
CTCEU identifies both foreign students who fail to enroll in or maintain 
status at their schools and SEVP-certified schools that do not remain in 
compliance with program requirements. For example, CTCEU takes the 
lead in pursuing criminal investigations against school officials that may 
have exploited the system by operating “sham” institutions, which are 
operating solely to admit foreign nationals into the country without 
participation in educational programs. CTCEU refers leads to ICE field 
offices for further review and investigation, and these offices also open 
their own investigations based on local leads. CTCEU also conducts 
outreach to schools through its Campus Sentinel program which aims to 
foster relationships between ICE law enforcement officials and schools 
through on-site visits and information sessions at national and regional 
conferences. 


Identifying and 
Assessing Risks to 
SEVP Could 
Strengthen ICE’s 
Management of the 
Program 


ICE does not have a process to identify and analyze risks across schools 
applying for certification, as well as across the more than 10,000 schools 
that are SEVP-certified. Specifically, SEVP faces two key challenges in 
(1) evaluating information on prior and suspected cases of school 
noncompliance and fraud, and (2) obtaining and assessing information 
from CTCEU and ICE field offices’ investigations and school outreach 
events to identify possible trends and lessons learned. In addition, ICE 
has not conducted an analysis to assess how to allocate resources based 
on risk to help ensure that SEVP resources are targeted to the highest- 
risk program activities. ICE has taken initial actions to study the potential 


25 Withdrawing a school’s certification is the final action in the compliance process. SEVP 
notifies schools of withdrawal decisions through a letter and schools have an opportunity 
to appeal these decisions. If SEVP denies the appeal, the program disseminates an 
official notification of certification withdrawal to the school. SEVP requires students who 
are enrolled at a school that is withdrawn from the program to transfer to another SEVP- 
certified school to maintain their student visa status. 
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risks posed by schools that are not in compliance with requirements, but it 
is too early to evaluate the results of these actions. 


ICE Does Not Have a 
Process to Identify and 
Assess Risks Posed by 
Schools in SEVP 


ICE has not developed and implemented a process to identify and 
analyze program risks since assuming responsibility for SEVP in 2003, 
making it difficult for ICE to determine the potential security and fraud 
risks across the more than 10,000 SEVP-certified schools and to identify 
actions that could help mitigate these risks and reduce schools’ 
noncompliance. SEVP and CTCEU officials expressed concerns about 
the security and fraud risks posed by schools that do not comply with 
program requirements. For example, investigators at CTCEU and each of 
the eight ICE field offices we interviewed told us that they are concerned 
about the cases of school certification fraud they have seen. They stated 
that identifying and assessing risk factors, such as the type of school 
(accredited or unaccredited), is critical to addressing security 
vulnerabilities and removing opportunities for criminal exploitation within 
SEVP. In 201 1 , CTCEU began tracking data on school fraud using 
increased resources funded with SEVP’s fee collections. For example, 
CTCEU focused more attention on fraud detection through its SEVIS 
Exploitation Unit, established in September 201 1 , which analyzes SEVIS 
data to identify potentially fraudulent activity among schools and allows 
CTCEU to generate additional leads on school fraud or noncompliance. In 
its Fiscal Year 2013 Congressional Budget Justification, DPIS reported 
that during fiscal year 201 1 , CTCEU analyzed 48 percent more leads on 
potential school and student visa fraud than in fiscal year 2010. In 
addition, various cases of school fraud have demonstrated vulnerabilities 
in the management and oversight of SEVP-certified schools. For 
example: 

• In the case of California Union University, foreign students stated they 
paid the school owner fees ranging from $600 to more than $10,000 
for documentation enabling the students to fraudulently obtain visas 
and, in some cases, bogus degrees, despite the fact that they never 
attended class. In the case affidavit, one student who purportedly 
received his bachelor’s degree in education from California Union 
University recounted how the school owner staged a graduation 
ceremony at the campus where students received their phony 
diplomas. 

• In the case of Florida Language Institute, foreign nationals who had 
been issued Forms 1-20 — a key document required in obtaining a 
student visa — were not required to attend classes. When ICE officials 
conducted a site visit at the Institute while the school was supposed to 
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be conducting classes, no students were present. The school had 
reported to ICE that 150 students attended class daily. 

• In other instances, school officials have run criminal enterprises that 
are tied to illegitimate schools. For example, in the Tri-Valley 
University case in California, the owner was indicted for issuing 
fraudulent Forms 1-20, which falsely certified that its students were 
required to attend a full course of study. Investigators believe school 
officials were intentionally maintaining false information in SEVIS in an 
effort to acquire and maintain immigration status for students that 
were actually ineligible for that status. 

ICE could benefit from a process that identifies and analyzes risks 
because previous investigations of school fraud indicate that there are 
vulnerabilities within the program. Moreover, given that there are more 
than 10,000 SEVP-certified schools, identifying and assessing 
programwide risks could help ICE target its operations to those program 
areas that are of highest risk. Standards for Internal Control in the Federal 
Government provides guidance on the importance of identifying and 
analyzing risks, and using that information to make decisions. 26 These 
standards address various aspects of internal control that should be 
continuous, built-in components of organizational operations. One internal 
control standard, risk assessment, calls for identifying and analyzing risks 
that agencies face from internal and external sources and deciding what 
actions should be taken to manage these risks. The standards indicate 
that conditions governing risk continually change and periodic updates 
are required to ensure that risk information, such as vulnerabilities in the 
program, remains current and relevant. Information collected through 
periodic reviews, as well as daily operations, can inform the analysis and 
assessment of risk. Furthermore, DHS’s Policy for Integrated Risk 
Management states that DHS and its component agencies should use a 
risk-based approach when managing programs that includes, among 
other things, identifying potential risks; assessing and analyzing identified 
risks; and using risk information and analysis to inform decision making. 

SEVP faces two primary challenges to identifying and assessing risks 
posed by schools: (1) it does not evaluate program data on prior and 
suspected instances of school fraud and noncompliance and (2) it does 
not obtain and assess information from CTCEU and ICE field office 
school investigations and outreach events. Information from these 


26 GAO/AIMD-00-21 .3.1 . 
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sources could help ICE identify trends and lessons learned from prior and 
ongoing cases and outreach events, providing it with factors it could 
consider in identifying and assessing SEVP programwide risks. 

Evaluating SEVP information on prior and suspected cases of 
school noncompliance and fraud. SEVP does not have a process to 
evaluate prior and suspected cases of school fraud and noncompliance to 
identify lessons learned from such cases, which could help it better 
identify and assess program risks. SEVP has maintained a compliance 
case log since 2005 — a list of approximately 172 schools as of December 
201 1 — that officials have determined to be potentially noncompliant with 
program requirements. The compliance case log represents those 
schools that SEVP, based on tips and leads and out-of-cycle reviews, is 
monitoring for potential noncompliance. SEVP uses this log for monitoring 
potentially noncompliant schools, but, according to SEVP officials, it has 
not looked across schools on this list to identify and evaluate possible 
trends in schools’ noncompliance, which could provide useful insights to 
SEVP to assess programwide risks. Further, according to SEVP officials, 
SEVP has not looked across previous cases of school fraud and school 
withdrawals to identify lessons learned on program vulnerabilities and 
opportunities to strengthen internal controls. They stated that developing 
a comprehensive list of prior cases for school fraud would require 
significant time and effort because information on school fraud and 
noncompliance is maintained in multiple databases and files are not 
linked electronically and do not share information, including SEVIS, the 
Student and Exchange Visitor Program Automated Management 
System, 27 and paper-based case files. However, SEVP could use the 
existing compliance case log as a starting point to identify any trends or 
factors in schools’ noncompliance. Further, SEVP could select a sample 
of prior school fraud cases to analyze for possible trends and lessons 
learned, and leverage this analysis to help identify programwide risks. 

As of March 2012, ICE reported that it had withdrawn 860 SEVP-certified 
schools from the program since 2003 for various reasons including 
compliance issues, voluntary withdrawals, and school closures. ICE 
reported that it has withdrawn at least 88 of these schools since 2003 for 
noncompliance issues, such as failure to report a change in ownership. 


27 The Student and Exchange Visitor Program Automated Management System is a 
document management system that contains case file information on schools, such as site 
visit reports and evidence provided to support the 1-1 7petition. 
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However, a senior official told us that SEVP has not conducted a lessons 
learned evaluation of school withdrawals to determine potential trends in 
their noncompliant actions, and use that information to focus compliance 
activities. Our analysis indicates that there are patterns in the 
noncompliant schools, such as the type of school. For example, of the 
172 post-secondary institutions on SEVP’s December 2011 compliance 
case log, about 83 percent (or 142) offer language, religious, or flight 
studies, with language schools representing the highest proportion. 
CTECU identified, and shared with SEVP officials other potential 
indicators of higher-risk schools based on prior school fraud cases, 
including school location/type of campus; the ratio of foreign students to 
overall students; the ratio of enrolled students to reported average annual 
number of students; the concentration of online courses; and the average 
length of time that students, particularly foreign language students, have 
been in the United States. 

SEVP’s Policy Branch Chief told us that while the program has not 
conducted a comprehensive analysis of previous fraud cases, the Policy 
Branch developed a lessons learned analysis in response to the 201 1 Tri- 
Valley University case in California and submitted this analysis to SEVP 
senior management. In the Tri-Valley University case, the school’s owner 
was indicted for issuing fraudulent documentation without regard for 
students’ academic qualifications or intent to pursue a course of study 
required to maintain lawful immigration status. In February 2012, SEVP’s 
Director stated that he did not recall this analysis and thus had not made 
any policy or operational changes recommended in the analysis. He 
noted, however, that his office had made a number of changes as a direct 
result of the Tri-Valley University case, including establishing a separate 
compliance unit in August 201 1 and instituting a process to identify 
schools that have more enrolled students than their stated capacity, 
which is an indicator of risk. 28 The SEVP Director further stated that 
although the program has not systematically evaluated previous fraud 
cases, it has devoted increased attention to fraud prevention and 
detection since the Tri-Valley University case, such as through funding 


28 As part of initial certification, schools are required to report to SEVP their average 
annual number of students. In the case of Tri-Valley University, the school reported the 
average annual number of students as less than 100. However, at the time that ICE began 
investigating the school, the population of students was close to 1,000. Based on the Tri- 
Valley University case, SEVP officials stated that they began evaluating discrepancies 
between schools' average annual number of students and the number of Forms 1-20 
issued. 
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additional investigative resources in CTCEU. Officials at both SEVP and 
CTCEU stated that evaluating prior school fraud cases could help in 
assessing program risks, but the agency has not completed an analysis 
on data from school case files. According to DHS’s Policy for Integrated 
Risk Management, risk information and analysis can help provide 
defensible decisions, made with the best available tools and information, 
for the best achievable outcomes. In addition, the U.K. National Audit 
Office’s Good Practice in Tackling External Fraud advises that in the 
fraud context, a risk-based approach involves such things as assessing 
areas most vulnerable to fraud and the characteristics of those who 
commit fraud. SEVP officials told us that case information is not 
organized well, and that they generally operate on a reactive basis after 
evidence indicates that a fraud has been perpetrated and do not have 
sufficient quantitative data to help detect the fraud before it occurs. 
However, ICE could use its existing compliance case log and a sample of 
prior cases of school fraud, which contain qualitative information, as a 
starting point to help identify and assess factors that could pose security 
and fraud risks to the program. Without an evaluation of prior and 
suspected cases of school fraud and noncompliance, ICE is not well- 
positioned to identify and apply lessons learned from prior school fraud 
cases, which could help it take action to identify and mitigate program 
risks going forward. 

Obtaining information from CTCEU and ICE field offices’ 
investigations and outreach efforts. SEVP’s Director and other senior 
officials stated that SEVP has not established a process to obtain 
information from CTCEU’s criminal investigators. Investigators may have 
valuable knowledge in working cases of school fraud for identifying and 
assessing program risks, including information such as the characteristics 
of schools that commit fraud, how school officials exploited weaknesses 
in the school certification process, and what actions ICE could take to 
strengthen internal controls. For example, according to investigators in 
one ICE field office, CTCEU was hampered in pursuing a criminal 
investigation because SEVP officials did not obtain a signed attestation 
statement within the 1-17 application from a school official stating that the 
official agreed to comply with rules and regulations. Another risk area is 
designated school officials’ access to SEVIS. In 2011, CTCEU provided 
SEVP officials with a position paper expressing concerns that designated 
school officials, who are not required to undergo security background 
checks, are responsible for maintaining updated information of foreign 
students in SEVIS. Further, according to investigators at three of the eight 
field offices we interviewed, SEVP allowed designated school officials to 
maintain SEVIS access and the ability to modify records in the system 
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while being the subject of an ongoing criminal investigation, despite 
requests from CTCEU to terminate SEVIS access for these officials. The 
SEVP office has the authority to immediately terminate SEVIS access 
upon request from CTCEU in cases where criminal wrongdoing is 
suspected, and SEVP officials stated that they have taken action in the 
past to terminate SEVIS access due to noncompliance. SEVP’s Director 
stated that his office has, on occasion, requested more information or 
evidence from CTCEU to substantiate a request to terminate SEVIS 
access for a designated school official. In addition, he stated that, in some 
instances, his office may be hesitant to terminate access because doing 
so might alert the school to an open investigation and thus compromise 
CTCEU’s efforts. 

In addition to information from CTCEU’s criminal investigations, CTCEU 
collects data on its outreach efforts with schools through its Campus 
Sentinel program; however, the SEVP Director stated that his office has 
not obtained and analyzed reports on the results of these visits. CTCEU 
initiated Campus Sentinel in 201 1 , which ICE operates across all of its 
field offices nationwide. Funded with SEVP fee collections and facilitated 
based on SEVP’s outreach and liaison efforts with schools, the program 
aims to foster relationships between ICE law enforcement officials and 
schools through on-site visits and information sessions at national and 
regional conferences and to make school officials more aware of recent 
investigations of school fraud. CTCEU officials stated that the goal of 
Campus Sentinel is to enable CTCEU officials and schools to better 
identify and report criminal behavior within the population of certified 
schools. 

From October 1, 2011 through March 6, 2012, CTCEU conducted 314 
outreach visits to schools. According to CTCEU investigators that we 
interviewed, these visits provide an opportunity to identify potential risks, 
including whether schools have the physical capacity and necessary 
resources to support programs for foreign students. As of March 2012, 
CTCEU initiated two criminal investigations based on information 
obtained as part of Campus Sentinel outreach. ICE field offices document 
the results of each site visit, as well as information on school 
investigations, in the Treasury Enforcement Communication System 
(TECS), which is accessible to SEVP officials in the compliance unit, 
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including an SEVP compliance liaison in CTCEU. 29 Standards for Internal 
Control in the Federal Government states that management needs to 
comprehensively identify risks and ensure there are adequate means of 
obtaining information from external stakeholders that may have a 
significant impact on the agency achieving its goals. SEVP officials, 
including the Director, stated that the program conducts ongoing outreach 
with schools through annual conferences and efforts related to the 
Campus Sentinel program, among other things. The Director indicated 
that SEVP officials helped launch and fund it through SEVP fee 
collections, but were not aware of the site visit reports and thus have not 
taken steps to obtain information on them. A senior SEVP official stated 
that the program lacks processes to obtain information from CTCEU due 
to a strained relationship between the organizations. CTCEU officials 
disagreed that the relationship is strained and stated that there are 
processes in place to share information, such as through regular, 
bimonthly meetings between CTCEU and SEVP officials that began in 
late 201 1 ; however, they stated that SEVP has not adequately 
emphasized enforcement in its mission. In February 2012, SEVP’s 
Director stated that data on the results of Campus Sentinel would be 
valuable and planned to follow up with staff on how best to utilize access 
to available case information in TECS. Obtaining information on lessons 
learned from CTCEU investigators could help provide SEVP with 
additional insights on such issues as characteristics of schools that have 
committed fraud and the nature of those schools’ fraudulent activities, 
which ICE could leverage in identifying and assessing programmatic 
risks. 

In addition, ICE has taken some initial actions to study the potential risks 
posed by schools that are not in compliance with SEVP requirements, but 
it is too early to evaluate the results of these actions. Specifically, in 
September 201 1 , ICE hired a contractor to develop a risk-based 
approach to overseeing schools applying for certification as well as those 
already certified schools under the program. The objective of this contract 
is to define and document programmatic risks and incorporate such 
information into a risk-based approach to school oversight. As of March 
2012, the contractor had reviewed ICE’s SEVP standard operating 
procedures and interviewed agency officials responsible for school 


29 TECS is an automated enforcement and antiterrorism database that provides 
information for law enforcement and border security purposes, and can exchange 
information automatically with other U.S. government systems. 
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certification and recertification, among other areas. Using the results from 
background research and interviews of subject matter experts, the 
contractor completed several deliverables, including identifying and 
defining preliminary program risks (e.g., non-accredited schools); 
developing a risk scorecard, which ICE plans to use to categorize schools 
by risk level (e.g. high, medium, low); and developing a risk-based testing 
plan to ensure that adequate internal controls exist and are followed. 
However, this methodology was limited because ICE does not have 
complete and reliable historical data on its schools, according to the 
contractor. In November 2011, the contractor reported that there are 
several key limitations to its ongoing analysis of risk factors in SEVP, 
including that it must rely on qualitative, rather than quantitative data. In 
particular, the contractor reported that it faced challenges in accessing 
compliance data, given that is it maintained in multiple data sources. 
SEVP’s Deputy Director stated that DHS’s Office of Risk Management 
Analysis has begun developing such quantitative data separate from its 
risk management contract. As of March 2012, ICE has not yet 
implemented any of the contractor’s recommendations because the 
contractor had just completed the work. Going forward, ICE plans to 
evaluate the results before determining actions for implementation. 


ICE Has Not Allocated SEVP revenues have increased in recent years, but ICE has not analyzed 

SEVP Resources Based on how to allocate its resources among mission areas, such as certification, 
Program Risks compliance monitoring, and recertification. Once ICE has assessed risks 

' : * ^ in SEVP, analyzing how to allocate resources based on those risks could 

help ensure that SEVP is using its resources in a cost-effective manner. 
We have previously reported that homeland security resource 
investments should be informed by risk. 30 In particular, we reported that 
DHS must carefully weigh the benefit of homeland security endeavors 
and allocate resources where the benefit of reducing risk is worth the 
additional cost. Additionally, risk-based, priority-driven decisions can help 
inform decision makers in allocating finite resources to the areas of 
greatest need. In the homeland security arena, this means determining 
which vulnerabilities should be addressed in what ways with available 
resources. 


30 GAO, Strategic Budgeting: Risk Management Principles Can Help DHS Allocate 
Resources to Highest Priorities, GAO-05-824T (Washington, D.C.: Jun. 29, 2005). 
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SEVP is funded entirely by the fees that ICE collects from schools and 
students. In fiscal year 2009, based on an internal fee study, application 
fees for students and schools increased, which contributed to 
approximately 60 percent increase in fee collection revenue from fiscal 
year 2008. 31 As shown in table 1 , fee collections for SEVP have 
increased from approximately $53 million in fiscal year 2006 to about 
$1 23 million in fiscal year 201 1 . Subsequent fee studies in 2009 and 201 1 
projected that the program’s revenues would be sufficient to meet 
resource needs for the period covering fiscal years 2009 through 2013. 


Table 1 : ICE’s Budget Authority, Obligations, and Fee Collections for SEVP, Fiscal Years 2006 through 2012 


Dollars in millions 



2006 

2007 

2008 

2009 

2010 

2011 

201 2 a 

Enacted budget authority 

66.6 

54.3 

56. 2 b 

120.0 

120.0 

120.0 

120.0 

Fee collections 

52.9 

57.9 

63.3 

101.0 

113.2 

122.7 

33. 9 C 

Obligations 

45.8 

44.7 

63.0 

81.0 

72.9 

95.6 

120.0 


Source: GAO analysis of SEVP documentation and DHS budget data. 

a Based on fiscal year 201 2 enacted budget authority. 

b SEVP also received $9.7 million in supplemental funding in fiscal year 2008. 

c Data as of March 2012. Also, SEVP’s forecast takes into account that the majority of some fee 
payments occur during the second half of the fiscal year. As a result, 73 percent, or $93 million, of 
SEVP’s revenue is forecast to be collected over the remaining months in 201 2. 


With the exception of fiscal year 201 1 , ICE’s fee collections for SEVP 
since fiscal year 2009 have generally fallen short of its enacted budget 
authority. 32 ICE had intended to use the projected increases in fee 
collections to fund several initiatives, including developing SEVIS II, 
establishing field liaisons nationwide for school coordination and 
monitoring purposes, and hiring additional personnel for recertification. 


31 In fiscal year 2009, student fees increased from $100 to $200; school certification and 
petitions for change in ownership fees increased from $230 to $1 ,700; school site-visit 
fees increased from $350 to $655; and additional campus site visit increased from $350 to 
$655. 

32 Budget authority refers to the authority provided by federal law to enter into financial 
obligations that will result in immediate or future outlays involving federal government 
funds. The basic forms of budget authority include (1) appropriations, (2) borrowing 
authority, (3) contract authority, and (4) authority to obligate and expend offsetting receipts 
and collections. See GAO, A Glossary of Terms Used in the Federal Budget Process, 
GAO-05-734SP (Washington, D.C.: Sept. 2005). 
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SEVP deferred funding these initiatives, however, for a number of 
reasons such as challenges in designing SEVIS II, delays in hiring 
additional staff members, and lower than expected fee collections. For 
example, based on the fiscal year 2009 fee increase, ICE planned to 
allocate approximately $3 million to hire additional staff for SEVP 
recertification; however, an SEVP official stated that they did not 
complete hiring these staff in fiscal year 2010 because of the 
unanticipated reduction in fee collections. 33 A senior policy official 
indicated it is important to hire additional staff for recertification activities 
to help address school noncompliance and meet the statutory 
requirements for recertification as set forth in the Border Security Act. 
Although fee collections were lower than expected during this time frame, 
from October 2008 through October 201 1 , SEVP’s carryover cash 
balance increased from approximately $40 million to $105 million. SEVP’s 
Director stated that the program transferred staff from the Policy Branch 
to the compliance unit in 201 1 , and that there may be additional 
opportunities to target resources based on risk. SEVP is a fee-funded 
program, and revenues can and do fluctuate from fiscal year to fiscal year 
(see Table 1). However, SEVP’s director stated that SEVP has not 
conducted an analysis of its resource allocations based on risk to ensure 
that those resources are allocated in an efficient manner to high-risk 
activities. Additionally, in February 2012, SEVP’s Director realigned the 
organization into two main divisions, one focused on internal operations, 
such as information technology and human resources, and one focused 
on external operations, such as school certification. However, he stated 
that SEVP had not conducted a resource analysis or considered risk 
information to support this reorganization. By analyzing how to allocate its 
resources based on risk, SEVP could be better positioned to ensure that 
it is using those resources in a cost-effective manner to help address the 
program’s highest risk activities. 


33 SEVP plans to complete hiring additional staff for recertification activities by the end of 
fiscal year 2012. 
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Weaknesses in ICE’s 
Monitoring and 
Oversight of SEVP- 
Certified Schools 
Contribute to Security 
and Fraud 
Vulnerabilities 


ICE has not consistently implemented certain controls to verify schools’ 
legitimacy and eligibility during initial SEVP-certification and ongoing 
monitoring processes. In particular, ICE has not consistently implemented 
policies that require schools offering flight training to have certain FAA 
certifications to remain eligible to enroll foreign nonimmigrant students. In 
addition, weaknesses in managing and sharing information on SEVP- 
certified schools among ICE stakeholders hinder the agency’s efforts to 
prevent and detect school certification fraud. 


Inconsistent 

Implementation of Certain 
Controls Impede ICE’s 
Efforts to Verify and 
Monitor Schools’ 
Legitimacy and Program 
Eligibility 


ICE has not consistently implemented its procedures to verify and monitor 
schools’ legitimacy and eligibility, hindering efforts to prevent and detect 
school fraud. Regulations require schools to establish that the schools are 
legitimate and meet other eligibility criteria for the program to obtain 
certification from ICE. 34 ICE’s policies and procedures direct SEVP 
officials to collect, validate, and maintain evidence of schools’ eligibility 
during the initial certification, recertification, and ongoing review 
processes. Internal control standards advise that controls should be 
generally designed to ensure that ongoing monitoring occurs in the 
course of normal operations. Further, according to fraud control practices, 
agencies should strengthen internal controls where needed for fraud 
prevention. Fiowever, ICE officials have not consistently implemented 
existing internal control procedures for SEVP in four areas: (1) initial 
verification of evidence submitted in lieu of accreditation, (2) 
recordkeeping to ensure schools’ continued eligibility, (3) ongoing 
compliance monitoring of school licensing and accreditation status, and 
(4) certification of schools offering flight training. 


Initial verification of evidence submitted in lieu of accreditation. ICE 

requires schools to present evidence demonstrating that the school is 
legitimate; is an established institution of learning or other recognized 
place of study; possesses the necessary facilities, personnel, and 
finances to conduct instruction in recognized courses; and is engaged in 
instruction in those courses. Non-accredited, post-secondary schools, in 
particular, must provide “in lieu of” letters, which are evidence provided by 


34 8 C.F.R. § 214.3(a)(3) states that a school, to be eligible for certification, must establish 
that it is bona fide. For the purposes of this report, we use the term “legitimate” 
synonymously with the term “bona fide.” 


Page 21 


GAO-12-572 Student and Exchange Visitor Program 



petitioning schools in lieu of accreditation by a Department of Education- 
recognized accrediting agency. ICE policy and guidance require that 
SEVP adjudicators render an approval or denial of schools’ petitions 
based on such evidence and supporting documentation. 35 This includes 
verifying that schools’ claims in the Form 1-17 — such as accreditation 
status and “in lieu of” letters are accurate. Verifying an “in lieu of” letter 
would generally involve contacting the letter’s source and confirming that 
the letter is legitimate and that the signee has authority to issue 
statements of the school’s acceptance of the petitioning school’s credits 
and students. Based on our review of SEVIS data on the approximately 
10,000 SEVP-certified schools, we estimate that approximately 1 ,250 
schools are non-accredited, post-secondary schools and, therefore, 
should have provided “in lieu of” letters to ICE. 36 Plowever, SEVP 
adjudicators have not consistently verified “in lieu of” letters submitted by 
schools that demonstrate their legitimacy and eligibility. For example, 
according to SEVP’s School Certification Branch Chief, adjudicators have 
not verified all “in lieu of” letters submitted to ICE by the approximately 
1,250 non-accredited, post-secondary schools, as required by ICE’s 
policy. Rather, adjudicators use their discretion to determine whether to 
verify a letter’s source and the signatory authority of the signee based on 
any suspicions of the letters’ validity. Investigators at one of the eight ICE 
field offices we interviewed stated SEVP officials certified at least one 
illegitimate school — Tri-Valley University in California — because the 
program had not verified the evidence provided in the initial petition. 
These investigators directly attributed the initial certification of Tri-Valley 
University in California to the lack of verification of the school’s “in lieu of” 
letters. Investigators stated that if SEVP’s adjudicators had taken action 
to verify the letters, they may have discovered that the letters were 
manufactured by Tri-Valley University school officials to feign legitimacy 
and eligibility. 


35 SEVP adjudicators are federal government employees responsible for reviewing all 
school certification petitions, for researching and sending requests for additional evidence, 
and issuing a decision either certifying or denying schools’ SEVP-certification. 

36 To identify those schools that are post-secondary, we sorted SEVIS school data as of 
December 8, 2011, based on the “Type of Education” offered and excluded those schools 
that offered only elementary through high school education. From our list of post- 
secondary schools, we cross referenced each school's reported accrediting agency (if 
any) against the Department of Education's list of approved accrediting agencies. We 
considered schools non-accredited if they reported having no accreditation or reported an 
accrediting agency that was not approved by the Department of Education. 
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Furthermore, CTCEU officials and investigators at five of the eight ICE 
field offices we interviewed stated that School Certification Branch 
officials should scrutinize non-accredited schools to a higher degree 
because such schools have demonstrated a higher risk of fraud than 
other schools. Subsequent to investigation, Tri-Valley University closed 
and the owner was indicted on 33 criminal counts, including charges of 
visa fraud, money laundering, and alien-harboring. In another case, the 
owner of an English language school in Georgia provided fraudulent 
documents to ICE, including forged or fraudulently obtained “in lieu of” 
letters supposedly issued by three educational institutions of higher 
learning. Following the English language school’s certification, the school 
began facilitating the issuance of student visas to foreign nationals and 
further manufactured and provided false documents, including resumes, 
school transcripts, diplomas, financial plans and statements, to those 
foreign nationals. Furthermore, in March 2012, CTCEU officials stated 
that several of their ongoing investigations involve schools that provided 
fraudulent evidence of accreditation or evidence in lieu of accreditation to 
ICE. SEVP adjudicators have not consistently verified all evidence 
submitted in lieu of accreditation, specifically “in lieu of” letters” that 
support non-accredited schools’ petitions for SEVP certification because, 
according to SEVP officials, the program has not historically focused 
enough attention on fraud prevention until the Tri-Valley University case 
demonstrated the program’s vulnerabilities. In analyzing the Tri-Valley 
University case, a senior official in SEVP’s Policy Branch reiterated that 
adjudicators should verify all “in lieu of” letters per the program’s current 
procedures. Consistent verification of these letters could help ICE ensure 
that schools are legitimate and detect potential fraud early in the 
certification process. 

Recordkeeping to ensure continued eligibility of schools. ICE’s 
standard operating procedures for recordkeeping require SEVP officials 
to maintain records to document ongoing compliance. Our analysis of 
selected school case files indicates that ICE has not consistently 
maintained certain evidence of selected schools’ eligibility for the 
program. Based on our review of a stratified random sample of 50 SEVP- 
certified school case files, 30 files lacked at least one piece of evidence 
required by the program’s policies and procedures. In addition, ICE was 
unable to produce two schools’ case files that we requested as part of our 
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randomly selected sample. 37 The results of our analysis of the 48 
remaining case files are not generalizable, but the following summarizes 
these results. 

• 7 of the 48 school case files did not include reports of the required 
initial site visit; 

• 22 of the 48 school case files did not include proof of the designated 
school officials’ U.S. citizenship or lawful permanent residency; 

• 7 of the 34 case files for non-flight schools and non-accredited 
schools lacked adequate evidence in lieu of accreditation (e.g. “in lieu 
of” letters); and 

• 7 of the 1 1 case files for schools offering flight training included 
expired FAA certificates. 

Without the schools’ information and evidence contained in these case 
files, including attestation statements, site visit reports, and designated 
school officials’ proof of citizenship, ICE does not have an institutional 
record to provide reasonable assurance that these schools were initially 
and continue to be legitimate and eligible for certification. The Mission 
Support Branch Chief indicated that school case files may be missing or 
may lack pieces of evidence because of the transition from the legacy 
Immigration and Naturalization Service (INS) to DHS in 2003. DHS 
initially delegated authority for school certification and monitoring to U.S. 
Citizenship and Immigration Services (USCIS), but DHS later delegated 
that responsibility to ICE in February 2005. The Mission Support Branch 
Chief stated that DHS attempted to facilitate a smooth transition from INS 
and USCIS by accepting schools’ prior certifications without additional 
review. Although the INS offices where school case files had been 
maintained were required to send the school case files to USCIS, which 
subsequently transferred files to SEVP, the Mission Support Branch Chief 
and School Certification Branch Chief stated that some files were 
completely or partially destroyed prior to the transfer. The School 
Certification Branch Chief told us that ICE has not followed up on the 
missing case files and that files may be available from former INS offices. 
Both officials stated that they have not conducted an analysis of the gaps 
in school information among case files and do not know the number of 
files that may be incomplete or missing. The Mission Support Branch 
Chief stated that they have not prioritized the analysis of the case files 


37 Because ICE was unable to produce 2 schools' case files, our results include the 48 files 
that we were able to analyze. 
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because the program is relying on their various processes, including 
petition updates, compliance reviews, and recertification, to address 
previous deficiencies in information in case files. Based on our review of 
data on the initial certification dates of SEVP-certified schools, 7,130 of 
10,038 (71 percent) were certified prior to 2005, indicating that these 
schools were initially certified by INS or USCIS and then transferred to 
ICE. Internal control standards indicate that operating information, such 
as the evidence in school case files, is necessary to determine whether 
an agency is meeting its compliance requirements. Further, our analysis 
indicated that case files for schools that have been certified since 
February 2005 were also incomplete. Of the 30 schools that we identified 
as lacking at least one piece of evidence required by the program’s 
policies and procedures, 13 (46 percent) were certified from 2005 through 
2010. Therefore, gaps in the case files used to maintain evidence of 
schools’ eligibility affect those schools that ICE accepted from the former 
INS and USCIS as well as those that ICE certified after taking 
responsibility for the program. 

According to ICE officials, the school recertification process would help 
address issues with incomplete and missing school files because schools 
are required to resubmit all evidence required by regulation when going 
through recertification. The School Certification Branch Chief and the 
Policy Branch Chief stated that recertification would also help ICE 
address noncompliant schools and withdraw those that may have 
become illegitimate and ineligible since initial certification. The Border 
Security Act required recertification for all SEVP-certified schools (as well 
as State’s program sponsors of exchange students) by May 2004 and 
every 2 years thereafter. 38 Plowever, ICE began the first recertification 
cycle in May 2010 and, according to senior SEVP officials, will not 
recertify all schools during this 2-year cycle, which ends in May 2012, 
because the process has taken longer than officials planned. As of March 
31, 2012, ICE reported to have recertified 1,870 schools (approximately 
19 percent of SEVP-certified schools) during the program’s first 
recertification cycle (see figure 3). 


38 See 8 U.S.C. § 1762. The statute requires the review of institutions and other entities 
authorized to enroll or sponsor certain nonimmigrants. In addition to requiring DHS to 
review institutions certified to receive nonimmigrants under F and M visas, the act requires 
the Department of State to review entities designated to sponsor exchange visitor program 
participants under J visas. The Act requires that these reviews determine whether the 
institutions or entities are in compliance with recordkeeping and reporting requirements. 
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Figure 3: ICE’s Recertification Milestones 
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Source: GAO analysis of laws and ICE documents. 


Note: Border Security Act of 2002 required that INS recertify schools every 2 years; however, DHS 
assumed this responsibility when it took over management of SEVP in 2003. 


According to ICE, the program intended to complete approximately 450 
recertifications per month to finish the cycle in 2 years. However, it 
completed an average of 107 recertifications per month in 2011. 
According to SEVP’s Director and other senior officials, ICE delayed the 
recertification process until after SEVIS was deployed in 2003 and the 
program fee was increased in 2008 to support more staff in the program. 
SEVP senior management stated that the office is recruiting additional 
adjudicators, which may increase the program’s ability to recertify schools 
and potentially reach the program’s goal of recertifying 450 schools per 
month. Given the delays in completing the first recertification cycle, ICE is 
not positioned to address gaps in SEVP’s case files and cannot provide 
reasonable assurance that schools that were initially certified to accept 
foreign students are still compliant with SEVP regulations. 
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Ongoing compliance monitoring of school licensing and 
accreditation status. ICE does not have a process to monitor the 
ongoing eligibility of licensed and accredited, non-language schools 
enrolling foreign students. ICE regulations require all certified schools to 
maintain state licensing (or exemption) and provide various forms of 
evidence to ICE supporting schools’ legitimacy and eligibility. ICE has 
taken action to monitor the accreditation status of English language 
schools; however, it does not have a process to monitor schools’ state 
licensing status and non-language schools’ accreditation status. For 
English language schools, ICE is enforcing a legislative change enacted 
in December 2010, which requires, as of June 201 1 , such schools to be 
accredited by a Department of Education-recognized accrediting agency 
to be eligible for SEVP certification. 39 The act allows English language 
schools already certified on the date of enactment to continue issuing 
Forms 1-20 until December 2014, as long as they apply for accreditation 
by December 14, 201 1 . Subsequent to this change, ICE took actions to 
coordinate with nationally recognized accrediting agencies to determine 
which English language schools applied for accreditation by the 
legislatively mandated date of December 14, 201 1 . 

ICE does not have a similar process for monitoring the state licensing 
status of all schools and the accreditation of schools offering higher 
education or vocational training other than language training. If a school’s 
licensing or accreditation status changes after initial certification, ICE’s 
regulations and policy require designated school officials to report this 
change to ICE through SEVIS. 40 At initial certification, ICE requires 
designated school officials to report which agencies license or accredit 
their school in SEVIS, but the system allows school officials to list any 
response. For example, a school may list an accrediting agency that is 
not Department of Education-recognized in an attempt to fulfill SEVP 
requirements. Because schools may enter any information in this field, 
SEVP officials cannot easily query the number of schools that are 
accredited by Department of Education-recognized agencies or sort such 
data by the accrediting agencies. According to SEVP Information 
Technology officials, the planned November 2014 deployment of SEVIS II 
is intended to improve the program’s analytical capabilities by addressing 


39 See Act of Dec. 1 4, 201 0, Pub. L. No. 1 1 1 -306, 1 24 Stat. 3280. 
40 8 C.F.R. § 214.3(g)(2)(i). 
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the variation in self-reported licensing and accreditation statuses. 41 
Specifically, SEVIS II is intended to provide drop-down menus or other 
multiple choice selections for state licensing agencies as well as 
Department of Education-recognized accrediting agencies. These data 
collection tools are intended to address the inconsistent reporting of 
licensing or accrediting agencies’ names but not the issue of inaccurate 
(both intentional and unintentional) self-reporting by schools. Therefore, 
even with the planned SEVIS II deployment in 2014, ICE does not have 
reasonable assurance that SEVIS data on schools’ licensing or 
accreditation status is accurate following initial certification. If a school 
loses its state license, the school would be unable to operate legally as a 
school within that state. However, ICE does not have controls to ensure 
that SEVP compliance unit officials would be aware of this issue; 
therefore, a school without a proper business license may remain certified 
to enroll foreign students and the school’s designated school officials may 
continue to access SEVIS. For example, SEVP had been notified by ICE 
investigators that a religious school was closed in September 201 1 ; as of 
March 2012, the school remained SEVP-certified. In another example, 
SEVP officials learned in May 201 1 that a flight school had closed; as of 
March 2012, the school remained SEVP-certified. After we brought these 
issues to attention of ICE officials in March 2012, they stated that, while 
they initially thought these two schools had been withdrawn, the schools 
were SEVP-certified. ICE officials stated that they are working on 
withdrawing the schools. 

SEVP’s Policy Branch Chief and Deputy Director stated that they rely on 
the recertification process in addition to other methods, such as 
information-sharing with CTCEU and compliance reviews by the 
compliance unit, to verify that schools are self-reporting changes in their 
status consistent with ICE policies. However, ICE has not yet completed 
its first round of recertification of all certified schools. Moreover, since ICE 
is mandated to conduct recertification on schools every two years, a 


41 ICE is developing the functional requirements for SEVIS II, a second generation version 
of the data system that is intended to be more technologically advanced and user-friendly 
and to streamline the process of students obtaining student visas and studying in the 
United States. Initially planned for deployment in September 2009, SEVIS II has been 
delayed until November 2014 due to difficulties in system design. ICE terminated the 
original contractor based on its challenges in developing an accurate and complete set of 
functional requirements for the system, which required the agency to hire a new contractor 
for system design. ICE also plans to hire a contractor for SEVIS II development and 
implementation. 
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process to monitor the ongoing status of schools would help ensure their 
continuous eligibility. For example, this process could include notification 
from Department of Education-recognized accrediting agencies regarding 
changes in schools’ accreditation status. In addition to recertification, the 
SEVP Director stated that the planned field liaison initiative will improve 
school compliance, as well as data integrity in SEVIS. SEVP’s Director 
stated that the field liaisons will establish a more proactive relationship 
with schools and provide additional resources for schools and designated 
school officials to access to better understand and comply with 
immigration laws, regulations, and SEVP policies and procedures. 
Plowever, the initiative remains under development and ICE has not 
deployed any liaisons as of March 2012. Developing and implementing a 
process to monitor the ongoing status of schools enrolling foreign 
students could better position ICE to reduce the risk of fraud and ensure 
schools’ legitimacy and eligibility. 

Certification of schools offering flight training. ICE’s policies and 
procedures require flight schools to have FAA Part 141 or 142 
certification to be eligible for SEVP certification; however, ICE has 
certified schools offering flight training without such FAA certifications. As 
the federal agency responsible for regulating safety of civil aviation in the 
United States, FAA administers pilot certification (licensing) and conducts 
safety oversight of pilot training. 42 FAA’s regulations for pilot training and 
certification can be found in three parts — Parts 61 , 141 , and 142. 43 Part 
61 relates to individual providers/instructors that are not subject to direct 
FAA oversight beyond the initial certification and subsequent renewal of 
each flight instructor’s certificate. Parts 141 and 142 outline requirements 
for flight schools and training centers. FAA oversees these Part 141 and 
142 flight schools and training centers with annual inspections and by 
reviewing and approving the schools’ facilities and programs. FAA 
requires the flight training programs to include, among other things, 
detailed training course outlines or curriculums for approval. ICE 
established a policy that requires Part 141 and 142 for eligibility in 
SEVP — and excluded Part 61 providers — because FAA directly oversees 


42 For more information on FAA’s oversight of pilot training, see GAO, Initial Pilot Training: 
Better Management Controls Are Needed to Improve FAA Oversight , GAO-12-1 1 7 
(Washington, D.C.: Nov. 15, 2011). 

43 Federal aviation regulations are found under title 14 of the United States Code of 
Federal Regulations (14 C.F.R. pts. 61 , 141 , and 142). 
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Part 141 and 142 flight schools and training centers on an ongoing basis. 
The Form 1-17 petition for certification specifies that only FAA Part 141 
flight schools are eligible to apply for certification to enroll foreign 
students. 

We identified 434 SEVP-certified schools that, as of December 201 1 , 
offer flight training to foreign students. 44 Plowever, 167 (38 percent) of 
these flight training providers do not have FAA Part 141 or 142 
certification. SEVP’s Director, Policy Branch Chief, and Compliance Unit 
Chief acknowledged that all SEVP-certified schools offering flight training 
do not have FAA Part 141 or 142 certification even though the program 
requires it. In 201 1 , SEVP’s compliance unit initially identified schools 
offering flight training that appeared to not have Part 141 or 142 
certification and began determining those schools’ statuses by contacting 
designated school officials and FAA Flight Standard District Offices. 45 
During the course of our review, the SEVP Director stated that they plan 
to take action to address these noncompliant flight schools. Specifically, 
he stated that his office plans to notify all SEVP-certified schools that do 
not have the required FAA certification that they must re-obtain Part 141 
or 142 certification. Moreover, SEVP School Certification Branch officials 
stated that they plan to coordinate directly with FAA to determine which 
schools have not met the requirements by the deadlines and will take 
withdrawal actions against such schools. While these are positive steps, 
SEVP officials have not yet established target time frames for 
implementing and completing these planned actions. Program 
management standards state that successful execution of any program 
includes developing plans that include a time line for program 
deliverables. 46 Setting target time frames to notify certified flight schools 
that lack FAA certifications that they must re-obtain Part 141 or 142 
certification could help ICE hold SEVP accountable for taking such 


44 This is a relatively small percentage of providers nationwide that offer flight training. 

45 As of April 2012, SEVP’s compliance unit identified 469 SEVP-certified schools that offer 
flight training and determined that 153 of those may not be Part 141 or 142 certified. The 
discrepancy in the population that we identified and the population that SEVP identified is 
due to the fact that SEVP’s compliance unit included schools that have issued Forms 1-20 
for flight training without having flight training approved through the Form 1-1 7 petition. 

46 The Project Management Institute, The Standard for Program Management© (Newton 
Square, Pa., 2006). 
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actions and better position ICE to reduce the risk of fraud and ensure all 
flight schools’ legitimacy and eligibility. 

There are various reasons why ICE has certified or allowed non-Part 141 
or 142 schools to remain in the program. For example, a DHS flight 
training working group conducted a flight study that found that many FAA 
Part 61 schools were providing equal if not superior instruction than Part 
141 schools. Based on that finding, the DPIS flight training working group 
recommended that ICE re-examine the program’s requirement for Part 
141 or 142 certification for flight schools to enroll foreign students. Based 
on the DPIS group’s recommendation, ICE conducted a preliminary 
review and certified a limited number of non-Part 141 or 142 flight 
schools. Specifically, ICE certified one Part 61 provider following a site 
visit during which SEVP officials determined that the provider was equally 
qualified as a Part 141 or 142 flight school. Subsequent to this 
certification, additional Part 61 providers petitioned for SEVP certification, 
resulting in the certification of at least two additional flight providers that 
did not meet SEVP’s policy requiring Part 141 or 142 certification. SEVP 
officials in the Policy Branch stated that the program certified these 
providers because, in their view, there is no difference in quality between 
Part 61 providers and Part 141 or 142 flight schools. 

ICE also indicated that in most of the cases, it may have initially certified 
flight schools with Part 141 or 142 certification but the schools allowed 
their FAA certification to expire, and ICE did not identify or take 
compliance action against these schools. Further, a senior SEVP 
compliance official stated that ICE may also be unaware of flight schools 
that have had their FAA certification revoked. We identified one school 
that offers flight training that remains SEVP-certified (as of February 
2012) after FAA revoked its Part 141 certification in 2007 for multiple 
violations, including certifying and graduating students who have not 
completed the required curriculum and training as well as not following 
FAA-approved courses of training. Senior SEVP officials stated that the 
school officials have never updated the school’s petition in SEVIS 
following its initial certification in 2003; thus, ICE was unaware of this 
revocation. Additionally, ICE was unable to locate the school’s case file 
upon our request. We also identified a previous case of school 
certification fraud involving a flight school in El Cajon, California. This 
school lost its FAA certification to train commercial pilots but remained 
SEVP-certified, continued to issue Forms 1-20 and enroll foreign 
nonimmigrant students, and illegally hired such students as flight 
instructors. Specifically, school officials issued Forms 1-20 in SEVIS for 
more than 100 foreign students in 3 months and illegally hired 11 such 
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students as flight training instructors from 2001 through 2008. According 
to ICE field investigators, the actions taken by the school and its officials 
posed a significant security threat, especially considering the schools 
involvement in flight training. In particular, CTCEU recommended in 201 1 
that SEVP should not allow Part 61 providers into the program. In 
November 201 1 , we reported that FAA rarely uses punitive means such 
as revoking licenses and assessing penalties against Part 141 schools, 
having revoked certificates in three cases. 47 Because ICE has certified or 
maintained certification of schools that provide flight training without the 
required FAA certification and oversight, the program is vulnerable to 
security and fraud risks. 

ICE has not consistently verified and maintained all evidence submitted in 
support of schools’ petitions and has not monitored schools’ state 
licensing, accreditation, and FAA certification status because, according 
to SEVP officials, ICE has not historically focused enough attention on 
fraud prevention and detection. To effectively prevent and detect fraud, 
Standards for Internal Control in the Federal Government, as well as the 
U.K. National Audit Office’s Good Practice in Tackling External Fraud, 
suggest agencies clearly define key areas of authority and responsibility 
for operating activities and develop specific strategies to coordinate their 
fraud control efforts, ensuring that someone is fully responsible for 
implementing the plans as intended. Following the case of Tri-Valley 
University, ICE created the SEVP compliance unit in August 201 1 to 
target more of the program’s resources on school oversight and to 
strengthen compliance monitoring. The SEVP Director stated that his 
office’s branches historically operated in an autonomous manner, which 
has created past coordination challenges when responding to compliance 
cases, and the newly established compliance unit aims to correct these 
issues. Fiowever, SEVP has drafted but not finalized the unit’s standard 
operating procedures as of April 2012. The SEVP official in charge of the 
compliance unit stated that SEVP has not finalized the compliance unit’s 
procedures because the unit was established quickly in response to Tri- 
Valley University and has relied upon previous compliance procedures 


47 GAO-12-1 17. In addition, we plan to report later in 2012 on general aviation security, 
including the Alien Flight Student Program, which is a program administered by the 
Transportation Security Administration to screen foreign nationals applying for flight 
training in the United States. We are conducting this work at the request of the House of 
Representatives Committee on Homeland Security and Subcommittee on Transportation 
Security. 
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when the process was managed by the School Certification Branch. 
Specifically, the compliance unit is responsible for addressing the 
deficiencies in SEVP’s ongoing monitoring of schools’ licensing and 
accreditation, as well as flight schools’ FAA certification. Because the 
compliance unit operates without clearly defined parameters, the majority 
of its fraud control efforts are reactionary and performed on an ad hoc 
basis. For example, SEVP’s compliance staff began comparing the 
number of Forms 1-20 issued to the schools’ reported number of students 
in reaction to the Tri-Valley University case, which highlighted that 
schools issuing Forms 1-20 well above the schools’ reported average 
number of students is a potential fraud indicator. SEVP officials stated 
that they plan to finalize their procedures by summer 2012. Completing 
procedures by which the compliance unit monitors school compliance 
could better position ICE to conduct fraud control efforts on a systematic 
basis, which could help provide ICE with reasonable assurance that 
previously certified schools remain legitimate and eligible on an ongoing 
basis. 


Weaknesses in Managing 
and Sharing Key 
Information Impede ICE’s 
Prevention and Detection 
of School Fraud 


ICE has not consistently followed the standard operating procedures that 
govern the communication and coordination process between SEVP, 
CTCEU, and ICE field offices. Specifically, these procedures delineate 
roles and responsibilities on criminal investigations and establish 
protocols for SEVP taking administrative actions against schools during 
and following a criminal investigation. In some instances, SEVP 
management has not followed CTCEU requests to take or cease 
administrative actions and has not referred potentially criminal cases to 
CTCEU in accordance with ICE’s procedures. ICE’s standard operating 
procedure for coordination requires SEVP to defer to CTCEU regarding 
whether to proceed with administrative actions during ongoing criminal 
investigations because criminal investigations take precedence over 
administrative actions. Additionally, this procedure states that ICE field 
offices determine the timing and extent of SEVP engagement in criminal 
investigations based on the needs of those investigations, which includes 
requesting SEVP to take administrative action in SEVIS to remove 
designated school officials’ access to the system and to withdraw school 
certification. ICE’s procedure also directs SEVP to refer allegations or 
leads revealing possible criminal violations to CTCEU in a timely manner, 
but it does not include criteria for determining when a compliance-type 
case under SEVP’s review becomes a potentially criminal case. Internal 
control standards advise agencies to develop strategies for coordinating 
fraud prevention and control efforts, including establishing means of 
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information exchange and developing approaches to identifying and 
addressing potential fraud. 

Under the standard operating procedure, CTCEU is to inform SEVP 
officials of a pending criminal investigation of school fraud (or other 
fraudulent activity) to prevent SEVP from unknowingly compromising 
such investigations through conducting compliance reviews or other 
administrative processes. The procedure requires that SEVP officials 
defer to the judgment of the CTCEU Unit Chief regarding whether to 
proceed with an administrative action or review during an ongoing 
criminal investigation. However, in our interviews with eight ICE field 
offices, field investigators at two offices gave examples of SEVP officials 
continuing administrative activities when asked to cease such activity. In 
one case, investigators stated that the target (an owner of a flight school) 
became suspicious of increased attention by SEVP officials and fled the 
United States in 201 1 to avoid prosecution. Our review of the December 
2012 compliance case log confirms that the SEVP office was aware of 
this specific criminal investigation and continued to take administrative 
actions. SEVP officials indicated that there were mitigating circumstances 
related to this case, including challenges in communicating with the ICE 
field office. SEVP officials also stated that SEVP and CTCEU 
management later agreed that the investigation was not compromised by 
SEVP’s administrative activities. In another ongoing case in California, 
field investigators stated that SEVP officials conducted a site visit to an 
institution following the owner’s indictment after the local ICE field office 
investigators instructed SEVP to stop administrative activities. SEVP’s 
Director stated that, in some cases, they believe it is necessary to 
communicate with or conduct routine activities related to schools under 
investigation in order to not alert these schools to a potential 
investigation. The SEVP Director stated that these two examples were 
outliers and that the program typically works well with the field office 
investigators, fully supporting criminal investigations and abiding by 
investigator directions to cease activity. 

The standard operating procedure also allows CTCEU and ICE field 
offices to request that SEVP take administrative action in SEVIS to 
support criminal investigations either while the investigation is ongoing or 
following the investigation. Such administrative actions may include the 
removal of designated school officials from SEVIS access or withdrawal 
of a school’s certification. Because each criminal investigation is unique, 
the procedures state that the ICE field office determines the timing and 
extent of SEVP engagement based on the needs of the investigation. 
However, an ICE field office provided us with an example of SEVP 


Page 34 


GAO-12-572 Student and Exchange Visitor Program 



officials not complying with this administrative action protocol. According 
to this field office, as of February 2012, although CTCEU requested 
withdrawal of a school, SEVP had not begun withdrawal procedures for 
the school or denied SEVIS access to a school owner, following the 
owner’s indictment in May 201 1 on charges including conspiracy and 
false statements. SEVP officials stated that they revoked the school 
owner’s SEVIS access following the indictment, but accidently restored 
his access following the owner’s call to SEVP’s response center. SEVP 
officials stated that the compliance unit immediately terminated the 
owner’s access after becoming aware of the situation. SEVP officials 
stated that, as of March 2012, the compliance unit is preparing the notice 
of intent to withdraw the school. 

SEVP officials stated that staff typically will follow instruction from CTCEU 
or field investigators regarding either ceasing or taking administrative 
action, but the SEVP office may not know which schools are under 
investigation and CTCEU and field offices may not be fully informed on 
SEVP’s policies and procedures. SEVP officials stated that they may 
conduct administrative activities on schools that are not known to be 
under investigation because CTCEU and field office investigators have 
not routinely shared information regarding which schools are under 
investigation. However, the SEVP Director stated that his compliance unit 
staff have access to the TECS database, which includes information on 
ongoing investigations being directed by CTCEU and field office 
investigators. He also stated that it is important for all program branches 
to coordinate to assure that those responsible for administrative activities 
do not continue activities when CTCEU or ICE field office investigators 
have requested such activity to cease. SEVP officials in the School 
Certification and Policy Branches stated that the program has previously 
taken administrative actions requested by CTCEU and ICE field offices in 
support of criminal investigations. However, these officials stated that 
because SEVP is responsible for taking administrative actions, the 
program officials need details on why the school is being withdrawn to 
include in the notice of withdrawal letters to protect the program against 
appeals and potential lawsuits. The SEVP Director stated that the 
standard operating procedure is a high-level document that does not 
account for the mitigating factors that may influence how his staff should 
respond to ongoing criminal investigations. According to the Director, the 
intent of the procedure, given past coordination issues, is to ensure his 
office receives ample notification from CTCEU of criminal investigations 
so that SEVP can take appropriate and timely administrative actions. The 
standard operating procedure does not specifically state what information 
CTCEU or field office investigators should provide to SEVP. Without 
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specification of this information, it will be difficult for CTCEU, field office 
investigators, and SEVP officials to share a clear of understanding of 
information needs for taking administrative action. Revising the standard 
operating procedure that governs the communication and coordination 
process between SEVP, CTCEU, and ICE field offices to more 
specifically delineate what information to share among the stakeholders 
during a criminal investigation could better position ICE to conduct 
criminal investigations and to better prevent and detect school fraud. 

In addition, while the coordination standard operating procedure for 
SEVP, CTCEU, and ICE field offices requires that SEVP refer allegations 
or leads revealing possible criminal violations to CTCEU in a timely 
manner, the procedure does not have criteria for determining when 
certain noncompliant activity becomes potentially criminal. The SEVP 
compliance unit first shared its compliance case log with CTCEU in 
October 201 1 , during the course of our review. Upon review of this 
information, CTCEU officials stated that several of the compliance cases 
could involve potential criminal violations. CTCEU officials identified 
examples of potentially criminal violations, including designated school 
officials sharing SEVIS passwords, a school not holding classes but 
reporting attendance, a school reporting its own address as students’ 
addresses, and a school charging additional fees for showing students as 
compliant. CTCEU officials stated that SEVP officials had not previously 
shared these cases with them; therefore, CTCEU had not distributed the 
information to ICE field offices as potential leads for further investigation. 
Officials at six of the eight ICE field offices that we interviewed reported 
not having opened any school fraud investigations based on leads from 
SEVP and have relied on locally generated leads. According to officials at 
all eight ICE field offices that we interviewed, referrals of schools that may 
exhibit criminal behavior within the offices’ area of responsibility would 
prove useful in that agents could better target these potentially fraudulent 
schools for further review or investigation. The Compliance Unit Chief and 
the Policy Branch Chief stated that the program had not previously 
shared its compliance case log or other information regarding the 
program’s compliance monitoring activities with CTCEU because the unit 
has never asked for such information. However, the coordination 
standard operating procedures as well as internal control guidance 
indicate that agencies could benefit from sharing internally generated 
information with key stakeholders, which may help with fraud 
management efforts. By establishing criteria for identifying potentially 
criminal activity, SEVP would be better positioned to adhere to existing 
requirements of referring criminal cases to CTCEU for investigation. 
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Conclusions 


ICE aims to facilitate study in the United States for hundreds of thousands 
of foreign students each year. Effective oversight of SEVP entails 
balancing this objective against the program’s potential risks, including 
security vulnerabilities and opportunities for criminal exploitation. To find 
this balance, ICE is responsible for identifying the risks posed by schools, 
and being in a position to mitigate them. ICE has taken initial actions to 
identify program risks; however, it has not analyzed available information 
to identify and assess programwide risks, and make resource allocation 
decisions based on identified risks. Identifying and assessing program 
risks based on various factors, including information on prior and 
suspected cases of school noncompliance and fraud, and information 
from CTCEU and field office investigations and outreach events, could 
better position ICE to determine actions to help prevent school 
noncompliance and fraud and to address noncompliance and fraud when 
they occur. Further, developing and implementing a process to identify 
and assess risks could allow ICE to identify and address program 
weaknesses, take actions to strengthen school oversight, and allocate 
program resources in a more efficient and effective manner. 

Moreover, there are opportunities for ICE to improve its ability to prevent 
and detect fraud through the initial certification and ongoing monitoring of 
schools. By implementing existing fraud control practices, ICE could 
enhance its ability to detect school certification fraud and gain greater 
assurance that its operations are designed to protect the integrity of the 
system, even as it strives to enhance service and address work backlogs, 
such as in the recertification process. Specifically, establishing 
procedures for verifying and ensuring the completeness of school 
evidence; addressing missing case files; monitoring the licensing, 
accreditation status, and FAA certification status of schools; and setting 
target time frames for completing procedures to address SEVP-certified 
flight schools that do not have, or have not maintained, required FAA 
certifications, could help ICE ensure that legitimate institutions participate 
in SEVP. Further, by strengthening coordination and communication 
between SEVP and CTCEU, ICE could better ensure that SEVP, CTCEU, 
and ICE field offices understand information to be shared with regarding 
whether to take administrative actions during criminal investigations and 
that clear criteria exist for referring cases from CTCEU based upon 
potentially criminal behavior. 
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Recommendations for 
Executive Action 

. Develop and implement a process to identify and assess risks in 
SEVP, including 

o evaluating prior and suspected cases of school noncompliance 
and fraud to identify potential trends, and 
o obtaining and assessing information from CTCEU and ICE field 
office investigative and outreach efforts. 

• Once a risk assessment process is in place, conduct an analysis of 
how to allocate SEVP’s resources based on risk and use the results of 
that analysis in making resource allocation decisions. 

• Consistently implement procedures for ensuring schools’ eligibility, 
including consistently verifying “in lieu of” letters. 

• Establish a process to identify and address all missing school case 
files, including determining the magnitude of the problem; obtaining 
required documentation for schools whose case files are missing 
evidence, as appropriate; and taking necessary compliance actions. 

• Develop and implement a process to monitor state licensing and 
accreditation status of all SEVP-certified schools. 

• Establish target time frames for notifying SEVP-certified flight schools 
that lack required FAA certification that they must re-obtain FAA 
certification. 

• Revise the standard operating procedure that governs coordination 
among SEVP, CTCEU, and ICE field offices to specify what 
information to share among stakeholders during criminal 
investigations. 

• Establish criteria for referring cases of a potentially criminal nature 
from SEVP to CTCEU. 


To enhance ICE’s ability to assess program risks, prevent and detect 
school certification fraud, and improve the controls over SEVP, we 
recommend that the Assistant Secretary of Immigration and Customs 
Enforcement take the following eight actions: 


Agency Comments 
and Our Evaluation 


We provided a draft of this report to DFiS and the Department of State for 
their review and comment. DFIS provided written comments, which are 
reproduced in full in appendix II. DFIS concurred with our eight 
recommendations and described actions under way or planned to 
address them. DFIS indicated that ICE plans to develop and complete a 
process to identify and assess risks in SEVP, as well as conduct an 
organizational analysis to determine if resources are properly allocated by 
risk. In addition, DFIS indicated that ICE is developing a quality assurance 
process to ensure the completeness of records associated with school 
certification. DFIS also indicated that SEVP personnel are developing 
procedures to ensure frequent validation of license or accreditation 
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information on SEVP-certified schools. These actions should help 
address the intent of our recommendations. DHS also provided technical 
comments, which we incorporated as appropriate. 

The Department of State did not have formal comments on our draft 
report, but provided technical comments, which we incorporated as 
appropriate. 


As agreed with your offices, unless you publicly announce the contents of 
this report earlier, we plan no further distribution until 30 days from the 
report date. At that time, we will send copies of this report to the 
Secretaries of Homeland Security and State, and appropriate 
congressional committees. In addition, the report will be available at no 
charge on the GAO web-site at http://www.gao.gov. If you or your staff 
have any questions concerning this report, please contact me at (202) 
512-6912, or gamblerr@gao.gov. Contact points for our Offices of 
Congressional Relations and Public Affairs may be found on the last page 
of this report. Key contributors are listed in appendix III. 



Rebecca Gambler 

Acting Director, Homeland Security and Justice Issues 
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The Honorable Charles E. Grassley 
Ranking Member 
Committee on the Judiciary 
United States Senate 

The Honorable Charles E. Schumer 
Chairman 

Subcommittee on Immigration, Refugees and Border Security 
Committee on the Judiciary 
United States Senate 

The Honorable Dianne Feinstein 
United States Senate 

The Honorable Claire McCaskill 
United States Senate 
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Appendix I: Scope and Methodology 


This report examines the extent to which U.S. Immigration and Customs 
Enforcement (ICE) has (1) identified and assessed risks in Student and 
Exchange Visitor Program (SEVP), and (2) developed and implemented 
policies and procedures to prevent and detect fraud during the initial 
school certification process and once schools begin accepting foreign 
students. 

To determine the extent to which ICE identifies and assesses risk in the 
SEVP, we analyzed program documentation, collected and analyzed data 
on the population of SEVP-certified schools as of December 8, 201 1 , and 
interviewed officials from the Department of Homeland Security (DHS) 
and its components. We evaluated the extent to which ICE’s practices 
were consistent with Standards for Internal Control in the Federal 
Government and DHS’s Policy for Integrated Risk Management - 1 In 
particular, we analyzed ICE and SEVP documentation, such as standard 
operating procedures, policy statements, and guidance for adjudicators, 
to determine how ICE’s processes and systems identify and assess risk 
in SEVP. To understand the magnitude of previous cases of fraud, we 
collected and evaluated information on previous cases of fraud through 
analyzing ICE press releases, as well as collecting documents and 
interviewing investigators from ICE’s Counterterrorism and Criminal 
Exploitation Unit (CTCEU). We reviewed publicly available information on 
1 2 cases of fraud dating from 2006 to 201 1 . The information obtained 
from these cases is not representative of all school fraud cases 
nationwide, but provided us with examples of school fraud. We also 
collected information from ICE on resources for SEVP, including budget 
data since fiscal year 2006, and information from ICE on SEVP’s contract 
to develop a risk-based approach for overseeing SEVP-certified schools. 
To evaluate ICE’s ability to identify and assess risk in SEVP, we 
examined information on SEVP’s data management systems, including 
the Student and Exchange Visitor Information System (SEVIS), SEVP 
Automated Management System (SEVPAMS), and 1-17 Tracking and 


^AO, Standards for Internal Control In the Federal Government , GAO/AIMD-OO-21 .3.1 
(Washington, D.C.: Nov. 1, 1999) and Department of Homeland Security, DHS Policy for 
Integrated Risk Management (Washington, D.C.: May 27, 201 0). 
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Reporting System. 2 We analyzed SEVP’s compliance case log, which 
identifies specific SEVP-certified schools that are under additional review 
for suspected noncompliant activity. We analyzed these schools for 
specific school attributes — such as the type of school — of the potentially 
noncompliant schools. To determine the potential threat posed by 
designated school officials, who issue the Forms 1-20 to the students and 
oversee all enrolled foreign students, we cross-referenced SEVP’s list of 
primary designated school officials (as of December 2011) with the 
Department of Justice’s National Security Division list of individuals 
convicted as a result of terrorism-related investigations through March 
2010, which was previously used in GAO’s work on criminal alien 
statistics, and found no matches. 3 

Moreover, we interviewed SEVP officials to evaluate the extent to which 
the program identifies and assesses risk. We met with senior officials 
from SEVP, including SEVP’s Director, Deputy Directors, and 
management for all branches — School Certification, Response, Policy, 
Analysis and Operations Center, Field Representative Program, Mission 
Support, and Information Technology. We also interviewed officials from 
CTCEU and criminal investigators from 8 of the 26 ICE field offices. We 
visited ICE field offices located in Atlanta, Georgia; Dallas, Texas; Miami, 
Florida; New York, New York; and Washington, D.C. We conducted 
telephone interviews with the ICE field offices in Los Angeles, San Diego, 
and San Francisco, California. We selected these locations based on a 
mix of criteria, including whether the office had any of the following 
characteristics: (1) investigated a case of school fraud; (2) had previous 
or current experience with school fraud based on CTCEU referrals; and 
(3) was investigating a school according to SEVP’s compliance case log 
during the period of this review. As we did not select a probability sample 
of ICE field offices to interview, the results of these interviews cannot be 
projected to all of ICE’s 26 field offices. Flowever, the interviews provided 


2 SEVIS is a web-based application that is used by SEVP-certified schools to submit 
petitions for certification and recertification, update petition information, issue forms to 
students, and update student data. SEVIS is used by SEVP to certify and recertify 
schools, track students, and monitor schools’ program compliance. SEVPAMS is a system 
used by SEVP and intended to store and create documents associated with SEVP- 
certified schools such as documentation of initial petition, compliance review activity, and 
school information updates. The 1-17 Tracking and Reporting System is a system used by 
SEVP and is intended to track the progress of schools applying for SEVP-certification. 

3 GAO, Criminal Alien Statistics: information on Incarcerations , Arrests and Costs, 

GAO-1 1-187 (Washington, D.C.: Mar. 24, 2011). 
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us with the perspectives of ICE officials responsible for conducting school 
fraud investigations, including their views on the processes SEVP has 
established for certifying and monitoring these schools and any 
challenges field offices have faced in their investigations. 

To determine the extent to which DHS has implemented policies and 
procedures to prevent and detect fraud, we analyzed the processes 
SEVP uses to (1) initially certify schools to enroll nonimmigrant foreign 
students; (2) maintain records to ensure schools’ continued eligibility; (3) 
monitor schools’ eligibility once certified; and (4) oversee schools offering 
flight training. We also analyzed the processes SEVP uses to manage 
and share key information with other ICE stakeholders, including CTCEU 
and ICE field offices. As part of our effort to evaluate these processes, we 
reviewed applicable laws and regulations, such as the Border Security 
Act and regulations governing nonimmigrant visa classes. 4 We also 
reviewed ICE’s standard operating procedures for certifying and 
recertifying schools, recordkeeping, compliance reviews, and information- 
sharing during criminal investigations. In addition, we reviewed SEVP’s 
internal policies and guidance specifically concerning English language 
and flight schools and the recertification process. We compared these 
processes to criteria established in laws and regulations, as well as to 
criteria in the Standards for Internal Control in the Federal Government , 
the U.K. National Audit Office’s Good Practice in Tackling External Fraud, 
and the Project Management Institute’s The Standard for Program 
Management. 5 

We collected and analyzed data from ICE’s SEVIS (as of December 8, 
2011) to identify schools certified by SEVP to enroll nonimmigrant foreign 
students under F and M visas. We assessed the reliability of these data 
by (1) reviewing existing documentation on the controls in the system and 
the policies for ensuring data reliability; and (2) interviewing agency 
officials about the data’s sources, the system’s built-in internal controls, 
and any quality assurance steps performed after data are entered into the 
system. We identified several limitations to the data due to ICE’s reliance 


4 8 U.S.C. § 1762. The regulations governing nonimmigrant classes are found in 8 C.F.R. 
pt. 214. 

5 U.K. National Audit Office, Good Practice in Tackling External Fraud (London, England: 
2008) and Project Management Institute’s The Standard for Program Management© 
(2006). 
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on school officials for data entry and updates. SEVIS is used by school 
officials to apply for and receive certification as well as to keep records of 
individual students who enter the United States on F and M visas. 
Although SEVP officials may allow a designated school official to make 
edits to the school’s petition, all data or information corrections are 
incumbent upon those school officials. Therefore, invalid data elements 
appear in the data, including entries for school names, as well as for 
mailing and physical location addresses, cities, and states. While we 
identified such limitations, we found the data sufficiently reliable for 
providing general background information on the population of SEVP- 
certified schools and selecting a sample of schools for which to conduct a 
case file review. We used SEVIS school data as the population from 
which to select a nongeneralizable stratified random sample of 50 SEVP- 
certified schools’ case files. To select the sample, we relied upon the data 
on certified schools (as of December 8, 2011) provided by SEVP. We 
focused our analysis on post-secondary schools that reported either 
being unaccredited or not being accredited by a Department of 
Education-recognized accrediting agency. We then stratified the 
population of post-secondary, unaccredited schools based on the 
schools’ reported type of education provided. These five strata included 
flight training, language training, religious training, combination of 
flight/language/religious training, and general post-secondary education. 
Our random sample of 50 SEVP-certified schools included at least one of 
each strata indicated. We analyzed the schools’ case files to evaluate 
SEVP maintenance of school records per program requirements found in 
SEVP’s recordkeeping standard operating procedure. Specifically, we 
verified that SEVP maintained historic and more current records of the 
schools’ accreditation or evidence provided in lieu of accreditation, school 
officials’ proof of citizenship or residency, school officials’ attestation 
statements, and flight schools’ FAA certification. 

Further, we used the SEVIS data to identify all SEVP-certified schools 
that offer flight training by querying the following SEVIS categories: Type 
of Education and Nature of Subject Matter. We cross-referenced the list 
of schools that reported offering flight training to FAA’s lists of Part 141 
and Part 142 schools. We also cross-referenced the list of SEVP-certified 
schools offering flight training to information on FAA certificate 
revocations. We previously used FAA’s data on Part 141 and 142 flight 
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schools and revocations in work on pilot training in the United States and 
found such data reliable. 6 

In addition to document and data collection and analysis, we interviewed 
the SEVP Director, Deputy Directors, and officials from SEVP’s branches 
as well as officials from CTCEU and our selected 8 SAC field offices to 
determine the extent to which ICE has policies and procedures to prevent 
and detect fraud within SEVP and to discuss SEVP’s management and 
information-sharing practices with CTCEU and SAC field offices. We also 
interviewed officials from Department of State to obtain officials’ views on 
State’s redesignation of exchange visitor sponsors and SEVP’s 
recertification of certified schools, which were both mandated in the 
Border Security Act. 

We conducted this performance audit from September 201 1 through June 
2012, in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit to 
obtain sufficient, appropriate evidence to provide a reasonable basis for 
our findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our findings 
and conclusions based on our audit objectives. 


6 GAO, Initial Pilot Training: Better Management Controls Are Needed to Improve FAA 
Oversight, GAO-12-1 17 (Washington, D.C.: Nov. 15, 2011). 
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Homeland 

Security 


May 10. 2012 


Rebecca Gambler 

Acting Director. Homeland Security and Justice Issues 
U.S. Government Accountability Office 
441 G Street. N\V 
Washington. DC 20548 

Re: Draft Report GAO-1 2-572. "STUDENT AND EXCHANGE VISI TOR PROGRAM: 

DUS Needs to Assess Risks and Strengths of Oversight Functions" 

Dear Ms. Gambler: 

Thank you for the opportunity to review and comment on this draft report. The U.S. Department 
ofHomeland Security (DUS) appreciates the U.S. Government Accountability Office's (GAO's) 
work in planning and conducting its review and issuing this report. 

The Department is pleased to note GAO's positive recognition of U.S. Immigration and Customs 
Enforcement (ICK) efforts to develop a risk based approach to school oversight to ensure that 
Student and Exchange Visitor Program (SKVP) resources are targeted to the highest-risk 
programs. For example, within the past year. ICE has established a separate ST VP compliance 
unit, instituted a process to identify schools that have more students than capacity, and funded 
additional resources in the Counterterrorism and Criminal Exploitation Unit (CTCEU). 

Also, during fiscal year (l-Y) 201 1. personnel in ICG's special Student and Exchange Visitor 
Information System Exploitation Unit analyzed nearly 50% more leads on potential school and 
student visa fraud than in FY 2010. Dt IS remains committed to strengthening its oversight 
functions and working w ith its partners throughout all levels of government, law enforcement, 
private industry, and in the public to ensure that foreign students studying in the United States 
comply with the terms of their admission into the country . 

The draft report contained eight recommendations with which DUS concurs. Specifically. GAO 
recommended that the Assistant Secretary of ICE: 

Recommendation 1 : Develop and implement a process to identify and assess risks in SEVP. 
including: 
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• evaluating prior and suspected eases of school noncompliance and fraud to identify potential 
trends: and 

• obtaining and assessing information from CTCEU and ICE field office investigative and 
outreach efforts. 

Response: Concur. Development and implementation of this process will be completed this 
fall, and will include a new policy. Beyond this. Sf VP personnel vs ill continue working to better 
document and incorporate the subject matter expertise of CTCEU and ICE field agents and their 
investigative and outreach efforts to create a more robust process that considers past 
noncompliant ease history . trends, and risks identified in the field, as appropriate. Estimated 
Completion Date (ECU): September 30. 2012. 

Recommendation 2: Once a risk assessment process is in place, conduct an analysis of how to 
allocate SEVP's resources based on risk and use the results of that analysis in making resource 
allocation decisions. 

Response: Concur. SEVP personnel have already started to dev clop the methodology for such 
an analysis based on a risk allocation process already in place in ICE. Upon implementation and 
monitoring of the risk-informed compliance process, SEVP plans to conduct an organizational 
analy sis to determine if resources are properly allocated by risk according to compliance or 
certification function. ECD: December 31. 2012. 

Recommendation 3: Consistently implement procedures for ensuring schools' eligibility, including 
consistently verifying in lieu of letters. 

Response: Concur. SEVP personnel have instituted mandatory verification of all schools in lieu 
of letters. Additionally. SEVP is developing a quality assurance process to ensure the 
completeness of records associated with school certification as well as consistent application of 
all regulations and policies. ECD: December 31. 2012. 

Recommendation 4: Establish a process to identify and address all missing school ease files, 
including determining the magnitude of the problem: obtaining required documentation for schools 
whose ease tiles arc missing evidence, as appropriate: and utking necessary compliance actions. 

Response: Concur. Prior to the finalization of GAO’s draft report, SEVP personnel had already 
approached ICE Records Management personnel to obtain guidance and assistance in developing 
protocols and actions to strengthen records management within SEVP. Depending on the results 
of this collaboration, additional actions will be taken, as appropriate. ECD: To be determined. 

Rccom mendation 5: Develop and implement a process to monitor state licensing and accreditation 
status of all SEVP-certilied schools. 

Response: Concur. Due to the large number of state licensing entities and U.S. Department of 
Education-recognized accreditation agencies nationwide. SEVP personnel arc developing 
procedures to ensure frequent validation of license or accreditation information This will 


2 
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include a new policy outlining a process to monitor state licensing and accreditation status of all 
SEVP-certilied schools. HCI): December 3 1. 2012. 

Recommendation 6: Establish target time frames tor notifying SEVP-certilied flight schools that 
lack required Federal Aviation Administration (FAA) certification that they must re-obtain FAA 
certification. 

Response: Concur. SEVP personnel have developed a list of all SEVP-certilied Might schools 
that currently do not have the required FAA certification. SEVP. in consultation with the FAA. 
is developing time frames to require those schools to re-obtain the required FAA certification. 
Additionally. SEVP and FAA lane developed a process to ensure SEVP becomes aware of any 
future loss of required FAA certification by a SEVP-ccrtificd flight school. Specifically. FAA is 
working on providing ICE access to its internal website which shows FAA Part 141 approvals. 
ECD: September 30. 2012. 

Recommendation 7: Rev ise the standard operating procedure that governs coordination among 
SEVP. CTCF.U. and ICE field offices to specify what infomiation to share among stakeholders during 
criminal investigations. 

Response: Concur. SEVP personnel will work with CTCKU and ICE field personnel to make 
the necessary revisions. ECD: September 30. 2012. 

Recommendation 8: Establish criteria for referring cases of a potcntiallv criminal nature from 
SEVP to CTCKU. 

Response: Concur. SEVP will work with CTCEU to develop appropriate criteria. In order to 
facilitate the process of identifying potential criminal violations of SEVP. the CTCEC will 
assign a Program Manager to SIVP. to maintain open lines of communication between the two 
offices as well as provide Treasury Enforcement Communication System training to the 
appropriate SEVP staff. ECD: December 31. 2012. 

Again, thank you for the opportunity to review and comment on this draft report. Technical 
comments on the report were previously provided under separate cover. We look forward to 
working with you on future Homeland Security issues. 


Sincerely. 

— 

Jim H. Crumpacker 
Director 

Departmental CtAO-OIG Liaison Office 
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